cve.bz

CVE-2026-128086 OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

5.3 mediumFix available

Medium (5.3) in open-telemetry opentelemetry-go. Fixed in go.opentelemetry.io/otel/baggage 1.47.0.

On this page
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into internal/baggage.Item. A valid densely populated baggage header can therefore cause allocation traffic and retained memory disproportionate to its bounded input size. Remote impact requires baggage extraction to be enabled, attacker-controlled input to reach it, and extraction to run before authentication or on a public route; the evidence establishes increased allocation and garbage-collection pressure but not reliable process termination. This issue is fixed in version 1.47.0.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWEs
CWE-400 Uncontrolled Resource Consumption
CWE-405 Asymmetric Resource Consumption (Amplification)
Published
Assigned by
GitHub_M (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-128086 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-128086?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-128086?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-128086 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-128086

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-128086](https://cve.bz/cve/badge/CVE-2026-128086.svg)](https://cve.bz/cve/CVE-2026-128086)

HTML:

<a href="https://cve.bz/cve/CVE-2026-128086"><img src="https://cve.bz/cve/badge/CVE-2026-128086.svg" alt="CVE-2026-128086"></a>

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
open-telemetry opentelemetry-go>= 1.0.0-RC1, < 1.47.0

Fix and patched versions

  • go.opentelemetry.io/otel/baggage (Go): fixed in 1.47.0
  • go.opentelemetry.io/otel/propagation (Go): fixed in 1.47.0

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rrfc-gjm9-cgrjGogo.opentelemetry.io/otel/baggage>=1.0.0-RC1 <1.47.01.47.0
GHSA-rrfc-gjm9-cgrjGogo.opentelemetry.io/otel/propagation>=1.0.0-RC1 <1.47.01.47.0

Attack patterns (CAPEC)

  • CAPEC-147 XML Ping of the Death Likelihood: Low · Severity: Medium
  • CAPEC-227 Sustained Client Engagement
  • CAPEC-492 Regular Expression Exponential Blowup

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON